为什么没有人回复呢？

在user32.dll中搜索几个十六进制字符，下断即可。
具体哪几个，不记得了。看文章。

It searches USER32.DLL for the following byte-pattern:
8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 E8

Once it is found, it returns you the address of the location it was found + 5.. i.e: before the memory copying.

This pattern should occur in the first 0x3FFFF bytes of USER32.
Example:

Code:

77D46706                 mov     eax, ecx
77D46708                 shr     ecx, 2
77D4670B                 repe movsd              ;  <-- break on this instruction
77D4670D                 mov     ecx, eax
77D4670F                 and     ecx, 3
77D46712                 repe movsb                 
77D46714                 call    sub_77D46722

I haven't researched this for long, but this piece of code appears to be where memory is copied from the gui-item to the user-supplied buffer. Tracing up a little brings up a bunch of references to SendMessage & GetWindowXXXX stuff... which would make sense.

nice job, to whoever found this.

搜索了，但是搜索不到啊

http://www.chinadfcg.com/viewthread.php?tid=7562